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QO. Is he -- is Mr. White your boss? 

A. IT wouldn't say he's -- he's my boss. 
He's my colleague. 

QO. And what -- within AlixPartners, what 
group do you work in? 

A. I work in the e-Discovery and forensics 
group at AlixPartners. 

Q. Is -- and are you aware that Mr. White 
also issued an expert report in this litigation? 

A. I'm aware that he issued expert reports 


previously, yes. 


Os Were you involved in the drafting of 


those reports? 

A. I assisted Mr. White in some of the 
draft -- the drafting of his device reports -- one 
of his device reports previously. 

QO. Was Mr. White involved in the drafting 


of your report? 





A. No -- insofar as he looked at the 
formatting and grammar, like I mentioned 
previously. 


ve Are you aware why Mr. White is no 
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longer a testifying expert in this case? 

A. I am not, no. 

Oe And you stated previously you were 
involved in the collection of documents in this 
Litigation. 

Were you involved in the collection of 
documents from the Defendant? 

A. I collected some documents at the 


Defendant's residence, yes. 





O. When was that? 

A. I believe that was February 2019. 

Os Have you been involved in any of the 
other document collection processes in this 
litigation, beside -- besides the -- the initial 
one that took place in February 2019? 


A. I've performed collections since then, 


or Which collections have you performed? 





A. I collected five of the Plaintiff hard 





drives that were presented to us for collection. 


QO. Outside of the initial collection in 


February 2019 from the Defendant and the collection 





MAGNA® 


LEGAL SERVICES 


Case 9:18-cv-80176-BB Document 548-4 Entered on FLSD Docket 06/01/2020 Page 4 of 15 


Confidential 


Page 29 


of the Plaintiffs' devices, have you participated 
in any of the collection of devices in this 
Litagation? 

A. Not that I'm aware of, off the top of 
my head, but I would have to review collection 
documentation to be able to say that with 
certainty. 

On Have you traveled in this -- outside -- 
you stated you traveled to the Defendant's home? 

A. Yes, correct. 

On In London or outside of London? 

A. It was outside of London, yes. 

Os Who else was at that -- who else 
assisted in that process? 


A. Do you mean from the AlixPartners team, 


or are you referring to other entities? 


Q. Yes, who was -- who was involved in -- 


anybody. Who was involved in the collection 





process at the Defendant's home? 
A. I was involved in the process; 
David White was there as well; and there were 


members of counsel, as well as additional forensic 
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looking at the file and its structure itself? 

A. That is one way to look at it, yes. 

Oe Okay. Outside of reviewing metadata, 
would you have done anything else with the file 
itself? 

A. As I mentioned, more than just the 
metadata, is looking at the actual content of the 
file with any sort of header, body attachment. I 
don't necessarily consider that metadata, but it is 


content and potentially relevant information. 





Q. So you would have reviewed metadata and 
the contents of the file. 

Is there anything -- is that a fair 
characterization of two of the things you would 
have done? 

A. Among others, yes. 


QO. Did Dr. Edman review the metadata and 


the contents of the files he opined upon? 





A. Based on his reports, he appears to've 
looked at certain pieces of metadata within those 
documents, yes. 


Ne And I"m. just. talking -= I"m ror. talking 
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about the eventual opinions he offered. 

Is there anything inaccurate in 
Dr. Edman's report relating to his 
characterizations of the metadata and the content 
of the files? 

A. Again, I wasn't in my report 
determining whether or not his facts were accurate. 
I was opining on his methodology and the 
conclusions that. he comes based on those [acts as 
it relates to specifically metadata and the content 
of a file. 


There were certain items related to IP 





addresses and others that I think are kind of a 
separate issue. 
Os Let me -- so you have no opinion on 


whether or not the -- Dr. Edman extracted the 


metadata correctly from the file? 


A. In my report, I wasn't opining on that, 





QO. And I'm not even -- I'm not looking at 
your report. 


Did you analyze whether Dr. Edman 
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reviewed the metadata correctly? 

A. I did not, no. 

We So sitting here today, you don't know 
whether or not Dr. Edman reviewed the -- accurately 


extracted the metadata from the files 





produced -- the files he opines on? 

A. From reviewing the exhibits, you know, 
I can make some determination on the fact that -- 
based on what sort of metadata he is pulling out 


and what sort of information he is extracting. 


Beyond that, I did not make a definitive conclusion 


on whether that was performed correctly in terms of 
actually extracting the data. 

on And you haven't formed any opinion 
whether he's done that incorrectly? 

A. I don't have an opinion either way. 

Q. Okay. So you would have reviewed the 


metadata, the contents of the file. 





The next thing you would have done -- 
LS it £aLr LO Say == Chaim or custody? 
A. Correct, that is one thing. Sure. 


Os Okay. Outside of metadata, contents of 
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the file, chain of custody, what else would you 
have done? 

A. Understanding -- and by "chain of 
custody," I mean, the historical significance of a 
file beyond just the actual are we into forensic 
process and the methodology of chain of custody, 
which is typically documenting how something was 
collected. But beyond that, we're looking at 
historical use of a document, how it came to be. 
All that is best forensic approach and something 
that we have to consider when analyzing a 
document. 

Os What do you mean by "historical use of 
a document"? 

A. So as an example, if I get a document 


from someone and I don't understand how that -- the 


background of that document, I just analyze it as 


is, my conclusion might be potentially incorrect or 





the possibility of a conclusion that I come to 
might be incorrect simply because I don't 
understand how that document came to be. But if 


someone is able to tell me, Oh, this document has 
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gone through four different e-mail systems and been 
scanned and OCR'd, that's a completely different 
Situation and something where we have to take the 
conclusions of the data that we're seeing ina 
document in a different light. 

Q. So you would've reviewed -- in your -- 
what you would have done -- correct me if I'm 
wrong -- is, I suppose, interviewed the person that 
the document came from? 


A. No, not necessarily interviewed, but, 





certainly, tried to determine the best -- to the 


extent that information is available and exists, 


how it was collected, where it came from and any 


sort of other historical information we can find 
out about it. 

Q. And how would you find out that 
information besides -- I mean, we talked about 


metadata content. 





I'm trying to understand -- it seems 
there's this additional layer analysis you would 
have performed, which is the context of the 


document. 
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Outside of a chain of custody review, 


how else would you have determined the historical 


context of a document? 

A. It depends on the document and what 
information might be available. 

Ox Ler’s talk about the documents chat 
Dr. Edman analyzed. 

What would you have done in relation to 
the documents Dr. Edman analyzed from the 
historical context? 

A. pure. 

So if there was a document that we 
could determine was collected from a certain device 
and we know that that device had, say, a label on 
it that indicated that it was belonging to a 
company or potentially a former employee at that 
company, that could -- that context could change 


the conclusions that we draw from our analysis of 





that document. 
Os What -- you collected some of 
Dr. Wright's documents in this case, correct? 


A. I collected some of his -- some of the 
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devices in his possession, yes. 

Q. What would you have done to determine 
the authenticity of those documents, besides 
reviewed their content and metadata? 

A. As I mentioned, I would look to the 
historical collection documentation that we have 


that might indicate other additional information 





about that document or the device where it was 
collected. from: 

Q. For the devices that you collected, 
what additional historical information can you tell 
us about those devices? 

A. It depends on the device. I would have 
to review collection documentation to determine 
exactly what was there, but, like I said, things 
such as labels on the device, papers inside the 
laptop lid, other information like that. 


Q. "Papers inside the laptop lid." 





How would papers inside the laptop lid 


give you any information about electronic device -- 


files stored within the laptop? 


A. It potentially could, because it's -- 





MAGNA® 


LEGAL SERVICES 


Case 9:18-cv-80176-BB Document 548-4 Entered on FLSD Docket 06/01/2020 Page 12 of 15 


Confidential 


Page 69 


it's common for, say, an IT person when they're -- 
say, if you take a laptop from someone and you put 
some identifying information about that laptop or 
who it came from, you can put that on a label ora 
piece of paper and attach that to the device. 
That's something that's certainly common and for 
us, as forensic examiners, might yield additional 
information that might flavor and provide context 
to our conclusion, 

O. Is it ever possible to determine the 
authenticity of a document from the metadata and 
contents of the document alone? 


A. Can you -- can you clarify for me what 


you mean by "inauthentic" or "inauthenticity"? 


Q. What's your definition of 
"jnauthenticity"? 
A. It would be something that's been 


altered for the purposes of deceit, essentially 





kind of a synonym for forgery. 
en So in your definition of 
"inauthenticity," you're assuming that there needs 


to be a layer of deceit involved in order to make a 
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determination of inauthenticity? 





A. In my experience and my expert opinion, 
the use of the word "forgery" or "inauthentic" 
implies intent, and attempting to state intent 
based on the contents of a single file alone, in my 
opinion, is unreasonable and not something I would 
do. I think you would need additional data points 
in order to perform that. 

Q. If so -- and so -- okay. JI understand. 

What word would you use to describe a 
file that has been altered but that you don't 
necessarily know the intent of that alteration? 

A. I think one possibility you could say 
is that that document has been modified. 

On The document has been modified. 

If Dr. Edman used the word "modified" 
instead of "manipulated" in his report, would you 


have any issues with the opinions he's offering? 





A. Again, I understand that Dr. Edman is 





offering an opinion, but in my experience, having 


the existence of a certain item of metadata that 


might indicate modification is not enough to make 
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definitive conclusion of modifications -- simply 
don't understand who made that modification, how it 
was done, when it was done -- potentially that 
might be available -- but to state that something 
as a definitive conclusion has been modified 
instead of just a possibility, that's something I 
would not do. 

Oz Have you reviewed the documents 
Dr. Edman analyzed to determine whether or not they 
were modified? 

A. Based on my examination of the 
exhibits, I can determine that there potentially 
could be markers of modification, but to state that 
as an indication of forgery or inauthenticity or 
even a definitive conclusion of modification rather 
than just a possibility, I think is what this comes 
down to. 


Os Are there any documents you reviewed 





that you can, sitting here today, say were not 


modified, in your opinion? 


A. I don't have an opinion on that one way 


or another. 
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Q. You don't have an opinion on whether or 
not any of the documents that Dr. Edman reviewed 
were modified? 

A. Again, because that's not what the 
purpose of my rebuttal report was, I did not 
analyze those documents to determine whether or not 
the metadata that was being indicated is actually 
the result of a modification or not. I was merely 
looking at the methodology and the conclusions 
drawn from those facts. 

Il £hink it's 4 possibility of what's 
being seen but not a definitive conclusion. 

on It's possible that the documents that 
Dr. Edman cited to were modified? 


A. It's possible, yes. 





It's possible they were manipulated? 
Again, "manipulation" implies intent, 


I'm -- 





I'm asking is it possible. 


A. In the realm of possibility, yes, that 


is a possible explanation. 


Qe Is it possible that the documents that 
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